2417cbbd8b26d8278d90e73b653d756d4159117a92ca2e519f80df8a9b4fd04a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe
Size 1.4MB
Sample240426-zb1lasbf63
SHA256 2417cbbd8b26d8278d90e73b653d756d4159117a92ca2e519f80df8a9b4fd04a
MD5 019b9a8a7ddb01c484bfcea7bc2ed9f2
SHA1 93254b370bcc8d01f13c7d53addc219fd685fe13
SHA512 d377c6e45eb441a4756e80d4e9b569d10e0e8b820a2029ae5b4b5eedb97fdadd4dcf3609823778f008e24405a282b900dc2e44c3e7632adfc581e82a28b651a7
SSDEEP 24576:qXql1zqNGTlWbNDjqMx0XVNw7zsceeZkv9+oCDKDIAeYrRGEG:qXql12uWBDjqpXVsBpZkF+oTDbeYrRTG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3480	769.exe

Loads dropped DLL 3 IoCs

pid	Process
3480	769.exe
5020	regsvr32.exe
2080	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\jT.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caahikfibfgkeadophpdeepfamhdlhle\1.0\manifest.json	769.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ = "YoutubeAdblocker"	769.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\NoExplorer = "1"	769.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ = "YoutubeAdblocker"	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\jT.tlb	769.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\jT.dat	769.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\jT.dat	769.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\jT.x64.dll	769.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\jT.x64.dll	769.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\jT.dll	769.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\jT.dll	769.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\jT.tlb	769.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	769.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	769.exe
Key deleted	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	769.exe
Key deleted	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	769.exe
Key deleted	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ = "YoutubeAdblocker"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\jT.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ = "YoutubeAdblocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CurVer	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\VersionIndependentProgID	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	769.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\ = "YoutubeAdblocker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID\ = "{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\Implemented Categories	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\jT.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\ = "YoutubeAdblocker"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\VersionIndependentProgID\ = "YoutubeAdblocker"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\jT.dll"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\ = "YoutubeAdblocker"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	769.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}	769.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ProgID	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ProgID	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	769.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID\ = "{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\ProgID\ = "YoutubeAdblocker.1.0"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\CLSID\ = "{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}"	769.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\Programmable	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\CLSID\ = "{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	769.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	769.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 3480	248	019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe	84
PID 248 wrote to memory of 3480	248	019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe	84
PID 248 wrote to memory of 3480	248	019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe	84
PID 3480 wrote to memory of 5020	3480	769.exe	85
PID 3480 wrote to memory of 5020	3480	769.exe	85
PID 3480 wrote to memory of 5020	3480	769.exe	85
PID 5020 wrote to memory of 2080	5020	regsvr32.exe	86
PID 5020 wrote to memory of 2080	5020	regsvr32.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{DE7CEB73-B1A0-4B95-B276-05CF3F6FAFFF} = "1"	769.exe

C:\Users\Admin\AppData\Local\Temp\019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\019b9a8a7ddb01c484bfcea7bc2ed9f2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:248
- C:\Users\Admin\AppData\Local\Temp\00294823\769.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/769.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3480
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdblocker\jT.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\YoutubeAdblocker\jT.x64.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

769.dat

Path C:\Users\Admin\AppData\Local\Temp\00294823\769.dat
Size 3KB
SHA256 065814a9094b3daa36fbbc46fb2cf0336d7cfb90265fdc955439c998afa1d429
MD5 fb6bd7d3d711ccbfc6a9ed1b0b9080d3
SHA1 8b44b567c76ee92620f38ec2977744c8124541fc
SHA512 a8186f795b91c582b607b239745893682dfe2c1101fab999e5a1d778c30f4452371cd02f5a095db631e0f6a4065400fd463ff755d4e677b9dc9b2bbf4f8e1116
MD5 SHA1 SHA512

Submit Download

769.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\769.exe
Size 362KB
SHA256 4ac487c1e34acc2c3185865587007601f930e4ccdad25555b802589bb8e180c0
MD5 6e4fb7cd6786ef3886bfef7472b4d4b1
SHA1 ef51881e7917494d5ec67808bc705852906f553d
SHA512 62f2ede1013763182a9dd3a3c0375abe0317d3a163405ce4e327cba40a217901fd15155a9d5000c68e20e14cbe3c35dbbb9dbc1253e3716e2556e5665f24cc37
SSDEEP 3072:VaZA62ORvoCFgRiGR4V81BIYj0GrZB28fPKrcdV+VIAZU7yMHKQDuoML8fpUsYpB:VaZZFu5R4CIYjiCP0cdVAU7whMpUhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\background.html
Size 141B
SHA256 0cb4219716816bcd5f9b6d9c3625b7b0840e9f5e5c531817e88ed5866aa46923
MD5 e44ad2ffa7151218b315a0196be8de00
SHA1 196094577fd43ba869a800e691e5549868fc5a66
SHA512 a7be0c791c8ebe679505a5544a30d05e80d1586b320d3287afc91cae7e9c72ecc6b14459f30c8bcff5a6f0bc76ab2ed768011f6821e358efd41ade2a742eb5c3
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\manifest.json
Size 508B
SHA256 6e03e688a9f7cc23a788e004cea4c87ee73e36c1053d2fb34a214bcc597f3ea2
MD5 e2832fbedae560495781610b5c511afa
SHA1 95f9c6fe1ea5a6ee009bce1e9c215ef53fb5c108
SHA512 2e206b58d02a88d21cb0cd74d5523b9f07f4558b4af9a19936befb256c2dc868107ab1716849e09b665721d1ac7b01ba6762bb54822596e39a4cdad763c68cb9
MD5 SHA1 SHA512

Submit Download

qM4O.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\qM4O.js
Size 5KB
SHA256 763a20e7c6c058609803b3375f39928a74995b924fa21b85585723bc69bb9058
MD5 95cb6e3df096dfec2b1d39f9e90d6e52
SHA1 389eaaf8b51fd7bd53f792df46792191ba64f6a8
SHA512 c5ee2c47fa8fd56aaf8a8a44d2bda4dbfecce416dec925d245d3c16b00d51d0e0ebfecb2c84f0eef43474c4e46897bb0c253943adcae50213eb0cf6f4557e069
SSDEEP 96:Zh5LJxjTWgU0k0Q0Z09F040O0IF0x0X0pWN0wvpjeXY7/aU7HJJ0vOaC:/NKgU0k0Q0Z09F040O0IF0x0X0p7qpIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\caahikfibfgkeadophpdeepfamhdlhle\sqlite.js
Size 1KB
SHA256 3e57d3d67d50c5f732169be4f9ada70ed35b725ed912654dc9af2ec79ff64765
MD5 b29aca0273caca3ae625361d16475c63
SHA1 752e725f7bdaddc81dcb521ff97b59b10e6f36a1
SHA512 087356209b8fb49a66293c8cf381955e5ccdc9767152d35e2093986b715820b64627d60ac839f9388f1dc65ee2e11a2b8b014af28a6bbbaaed66c1c7d3508e9a
MD5 SHA1 SHA512

Submit Download

jT.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\jT.dll
Size 416KB
SHA256 e23b94a809d4306dce3c0fb5a7dc76ad25e133cb74daa489629419ba1d849ebe
MD5 b5e8219112f5de28e71487fd8c367b8f
SHA1 cc60f4497ee2328e43e89474c412d75a90be2e1b
SHA512 d4dd2a41ab9c17125263824f3f4b5c6f3a5f8dc7c78adc298391a6a18b495a521388e2c8524c5050b7452df89d048a12b014e711fef7e4ed8b439d8959a7357d
SSDEEP 6144:9/c93WBQEoIK6lNS1huqSFeACGcW6kbO36JDWZA+VbfDKHAN2xq:9/c93WBLKUvbhBukbrbqb+gAxq
MD5 SHA1 SHA512 SSDEEP

Submit Download

jT.tlb

Path C:\Users\Admin\AppData\Local\Temp\00294823\jT.tlb
Size 3KB
SHA256 2e46c45652d03653c407468ca871f4e910b4cec36af85853e2bd06f3fb7ad4ae
MD5 8d1f5f85eefb09e07c0f1357289b7251
SHA1 f9e39ac9d8e978d8fe834c527a6160eb58392e77
SHA512 df483e23bf19f90b07cf70d5e4bf7a26ece3bea39cc78b0dd652d179890000ec2c603841f5354e27676f60055094e13749ad6fc11dcf56aa8be32a8a7d916fd7
MD5 SHA1 SHA512

Submit Download

jT.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\jT.x64.dll
Size 463KB
SHA256 5b9f026657796490c626a88c1b7533fc23a1ee92b4bad819f4d0940e18d0c7ae
MD5 51869d78edfbeb04d0805522d9232518
SHA1 4c1a736dbf800b83580265a6c6ae2ebd13e0b3cc
SHA512 9f99165b2c27df5f43131d857340aeb197d24b00a7176943c98f9b45bd7919e4ce002f68c9c1ed03424f42a1ce94ff3968b315cf9f6d2edfba708d86fc2c03fc
SSDEEP 6144:vubh8V1Yg80MDKAjY9HzGSAAbMhj1jT9rtnzkSaTTKPn:vuEa0MDKaY9lAA+TdkSJP
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
Size 2KB
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
Size 98B
SHA256 ff0fccc63daf15632a5383e953c7eb58579a4bd6bb855818732452ccd2c0769c
MD5 78868ab723b7f31dcc8d479ec18b25c6
SHA1 53a267535ba350b454ccd2f10c336f5ec2b9a8ab
SHA512 02cf2c5a87758bedfe81b4dce446d3903a4254af132526c51e78aa9b4f77bd690a8bdfe5b10c6d9436ee7f29cfedc33e3717ca5b43ee774bb88c86aeff618c01
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
Size 9KB
SHA256 75e0a1f6cde33671fb3d44c884a97eca2d8bfe459057f8a4b70975e1b439d6db
MD5 99c15dcac084307a24141a6d7bbb80bf
SHA1 4784a5349a1026e05d80b7d106dd55687c4b79a3
SHA512 f911ed8b6c5bc3f5c2cf39cf4f917ee3c9b0e7f8611786d9929db8cd2228720dd90e1d6bd698dd59e23482554fb08a944aa45f91d40f992a39f8a968346b5a05
SSDEEP 192:lo3v4cCrjA235UsZkJn7ERhzMk0Q0Z09F040O0IF0x0X0ZVqkYTyac76:uvfgku1ZkJ4PzF1cMFHNlF4m4TyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
Size 610B
SHA256 af1b904a90c0d5d06b57622b0f54bd6465754b40569c0b6d1996608fdea54a6f
MD5 a3ceb3f7dfabb6510107f645ba056462
SHA1 116b23f298dd008f54875c5b7983b4f71a988a5b
SHA512 f3174f5cf40e9a02dc4fa47f6759f46f4e1facb98d5fce8d51cc466a726f254479d56225b168998f3df31f26c13953f3a7811ef645c9a1bfb5ba1d32330375a5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads